From 4f034016289f5a52073bfd012899dd3e202742b5 Mon Sep 17 00:00:00 2001
From: Nikita Popov <nikita.ppv@gmail.com>
Date: Mon, 18 Mar 2019 11:04:25 +0100
Subject: Partial fix for bug #77751

This avoids the segfault, but it will not make writing to the
SplFileObject during output shutdown work.
---
 ext/spl/spl_directory.c     | 13 ++++++-------
 ext/spl/tests/bug77751.phpt | 18 ++++++++++++++++++
 2 files changed, 24 insertions(+), 7 deletions(-)
 create mode 100644 ext/spl/tests/bug77751.phpt

diff --git a/ext/spl/spl_directory.c b/ext/spl/spl_directory.c
index f13a48a5ad..47b3521d63 100644
--- a/ext/spl/spl_directory.c
+++ b/ext/spl/spl_directory.c
@@ -97,6 +97,7 @@ static void spl_filesystem_object_destroy_object(zend_object *object) /* {{{ */
 			} else {
 				php_stream_pclose(intern->u.file.stream);
 			}
+			intern->u.file.stream = NULL;
 		}
 		break;
 	}
@@ -127,13 +128,11 @@ static void spl_filesystem_object_free_storage(zend_object *object) /* {{{ */
 		}
 		break;
 	case SPL_FS_FILE:
-		if (intern->u.file.stream) {
-			if (intern->u.file.open_mode) {
-				efree(intern->u.file.open_mode);
-			}
-			if (intern->orig_path) {
-				efree(intern->orig_path);
-			}
+		if (intern->u.file.open_mode) {
+			efree(intern->u.file.open_mode);
+		}
+		if (intern->orig_path) {
+			efree(intern->orig_path);
 		}
 		spl_filesystem_file_free_line(intern);
 		break;
diff --git a/ext/spl/tests/bug77751.phpt b/ext/spl/tests/bug77751.phpt
new file mode 100644
index 0000000000..23855c6f1b
--- /dev/null
+++ b/ext/spl/tests/bug77751.phpt
@@ -0,0 +1,18 @@
+--TEST--
+Bug #77751: Writing to SplFileObject in ob_start gives segfault
+--FILE--
+<?php
+
+echo "No crash.\n";
+
+$logfile = new SplTempFileObject();
+ob_start(function ($buffer) use ($logfile) {
+    $logfile->fwrite($buffer);
+    $logfile->fflush();
+    return "";
+});
+echo "hmm\n";
+
+?>
+--EXPECT--
+No crash.
-- 
cgit v1.2.1